The manual.

Think of it as two layers. Your normal wallet is the street-level account everyone can look at. Your NullCash vault is a back room on the same chain: the network can confirm every action in it is valid, but it cannot see who did it, how much moved, or (if you pay fees in private SOL) which token was involved.

Chain

Solana mainnet

Custody

Non-custodial; secrets are created and kept in your browser

Privacy engine

Zero-knowledge proofs (Groth16) over a shared note pool

Ways out

Fresh one-time Solana address, or any chain via cross-chain routes

1. 1Open a vaultHit Connect wallet and pick Create a NullCash vault. Choose a password for this device. You get a recovery key once; store it offline.
2. 2ShieldGo to Shield, pick a token and amount, and approve one signature from your public wallet. Your tokens become sealed notes.
3. 3Use itSend to any null2… address, trade inside the pool, or exit. No pop-ups: a relayer submits each proof for you.
4. 4LeaveWithdraw to a brand-new address, or use Private route / Privacy swap to land on another chain.

Private route and Privacy swap both run on a manual-deposit model. You get a quote, place an order, and then decide whether to fund it by sending SOL or a token from any wallet you like. Placing the order itself moves nothing.

• No sign-up and no wallet connection
• Each order has its own deposit address and deadline
• Track any order with its receipt ID

A note bundles four things: a token mint, an amount, an owner key and a random blinding value. What lands on-chain is only its fingerprint (a commitment), written as a leaf in a Poseidon Merkle tree that is 26 levels deep, which is room for 67,108,864 notes.

When you spend a note you publish its nullifier, a one-way tag the program stores in a spent list. The same note can never be spent twice, and nobody can trace which commitment a nullifier belongs to.

Incoming payments are found by your browser trial-decrypting each new note ciphertext with your viewing key. The indexer serves everyone the same feed, so it never learns which notes are yours.

Every private action ships with a zero-knowledge proof that says, in effect: I own a note that is really in the pool, I am allowed to spend it, and the totals add up. The verifier checks the maths and learns nothing else.

• Membership: each spent note sits under the current Merkle root
• Authority: the spender holds the matching spending key
• Uniqueness: nullifiers are derived correctly, so no double-spends
• Conservation: inputs + public amount = outputs + fees

proof system   Groth16 on BN254
circuit        Transaction(levels 26, in 4, out 3)
public inputs  13
hashing        Poseidon
on-chain check alt_bn128 syscalls

A relayer takes your finished proof, wraps it in a transaction and pays the network fee, taking a small relayer fee from the note in return. The recipient, amount, fee and any swap terms are bound into the proof hash, so a relayer that tampers with anything just produces a failed transaction.

Private trades run in two moves. swap_prepare locks the input into a dedicated escrow, then swap_execute runs the route. The program confirms the escrow paid exactly the input and the vault got at least your minimum; if not, swap_refund puts everything back.

Your vault starts as 32 random bytes. From that seed the browser derives a spending key, a viewing key and an endless supply of single-use receive addresses. On this device the bundle is locked with your password (PBKDF2 at 600k rounds, then AES-GCM).

The recovery key is shown once and restores the whole vault anywhere. Because it is independent of your public wallet, losing one never exposes the other.

1. 1Pick a pairChoose a Solana token to send and any destination token and chain.
2. 2CompareSeveral live routes appear with output, ETA and limits. They refresh before they expire.
3. 3Place the orderAdd the receiving address. You get a deposit address, plus a memo if one is required.
4. 4Fund itSend the exact amount on Solana before the timer runs out.
5. 5Watch itStatus runs: waiting for deposit, confirming, exchanging, sending, completed.

You describe the outcome you want: an exact Solana input, a destination asset and chain, a recipient and a Solana refund address. Market makers bid to deliver it and the best bid becomes your quote. Once you confirm, you get deposit instructions; after your deposit lands the solver pays out on the destination chain and the settlement contract finalises atomically. Failures refund to your Solana address.

Processing happens in a private shard run by permissioned validators, with encryption and restricted visibility. That is confidential execution rather than a zero-knowledge pool, so those validators sit inside the trust boundary.

Destinations

Solana, NEAR, Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, plus native Zcash (receive-only, shielded address)

Partner fee

0.40%, already reflected in the quote

Refunds

Always to the Solana refund address you set

Open Track, paste the receipt ID and the page polls the live status every few seconds. Recent orders are remembered in this browser so you can jump back with one tap.

GET  /api/ds/tokens?side=source|destination&term=&chain=
GET  /api/ds/quotes?from=&to=&amount=
POST /api/ds/orders        { from, to, amount, address, ... }
GET  /api/ds/orders/{id}   -> status, deposit, payout

• Let funds sit a while between shielding and withdrawing
• Avoid unique amounts; round numbers blend in
• Keep some private SOL so fees do not reveal the token
• Withdraw to a fresh address, never back to the wallet you shielded from
• Store the recovery key offline, away from this device